@loaders.gl/services 5.0.0-alpha.10

package/LICENSE

@@ -0,0 +1,52 @@
+loaders.gl is licensed under the MIT license
+
+Copyright (c) vis.gl contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+--- 
+
+Copyright (c) 2015 Uber Technologies, Inc.
+
+Portions of modules/images/src/lib/category-api/binary-image-api.ts are based on
+binary-gltf-utils (https://github.com/Qantas94Heavy/binary-gltf-utils) under the
+MIT License reproduced above.
+
+Copyright (c) 2016-17 Karl Cheng
+
+Portions of modules/schema-utils/src/lib/utils/async-queue.ts are adapted from
+async-iter-demo (https://github.com/rauschma/async-iter-demo) under the MIT
+License reproduced above.
+
+Copyright (c) 2016 Axel Rauschmayer
+
+loaders.gl includes certain files from Cesium (https://github.com/CesiumGS/cesium)
+under the Apache 2.0 License, including files in modules/3d-tiles.
+
+Copyright 2011-2018 CesiumJS Contributors
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and limitations under the License.

package/README.md

@@ -0,0 +1,12 @@
+# @loaders.gl/services
+
+Authentication presets for Mapbox, Google Maps and Cesium ion.
+
+Use `MapboxAuthentication`, `GoogleMapsAuthentication`, `CesiumIonAuthentication`, or their
+`create*Credential` helpers with the shared loaders.gl credential pipeline. Sign-in and token
+issuance remain application responsibilities.
+
+ArcGIS sources and credentials live in [@loaders.gl/arcgis](https://loaders.gl/docs/modules/arcgis).
+OGC protocol sources live in [@loaders.gl/wms](https://loaders.gl/docs/modules/wms).
+
+See the [authentication guide](https://loaders.gl/docs/developer-guide/authentication).

package/dist/authentication.d.ts

@@ -0,0 +1,62 @@
+import type { FetchLike, RequestCredential, TokenValue } from '@loaders.gl/loader-utils';
+import { TokenAuthentication } from '@loaders.gl/loader-utils';
+/** Declarative Mapbox access-token authentication. */
+export declare class MapboxAuthentication extends TokenAuthentication {
+    /** Discriminator used in `core.credentials`. */
+    static readonly type = "mapbox";
+    /** Creates a Mapbox credential with the existing provider defaults. */
+    constructor(options: MapboxCredentialOptions);
+}
+/** Declarative Google Maps API-key authentication. */
+export declare class GoogleMapsAuthentication extends TokenAuthentication {
+    /** Discriminator used in `core.credentials`. */
+    static readonly type = "google-maps";
+    /** Creates a Google Maps credential with the existing provider defaults. */
+    constructor(options: GoogleMapsCredentialOptions);
+}
+/** Declarative Cesium ion authentication, including lazy asset-token exchange. */
+export declare class CesiumIonAuthentication extends TokenAuthentication {
+    /** Discriminator used in `core.credentials`. */
+    static readonly type = "cesium-ion";
+    /** Creates an ion credential with the existing provider lifecycle. */
+    constructor(options: CesiumIonCredentialOptions);
+}
+/** Shared options for provider credential presets with known public API origins. */
+export type ServiceCredentialOptions = {
+    /** Replaces the provider's default exact-origin allowlist. */
+    origins?: readonly string[];
+};
+/** Options for a Mapbox API credential. */
+export type MapboxCredentialOptions = ServiceCredentialOptions & {
+    /** Mapbox public access token or application-managed token callback. */
+    accessToken: TokenValue;
+};
+/** Options for a Google Maps Platform credential. */
+export type GoogleMapsCredentialOptions = ServiceCredentialOptions & {
+    /** Google Maps Platform API key or application-managed key callback. */
+    apiKey: TokenValue;
+};
+/** Options for a Cesium ion API credential. */
+export type CesiumIonCredentialOptions = ServiceCredentialOptions & {
+    /** Cesium ion access token or application-managed token callback. */
+    accessToken: TokenValue;
+    /** Optional asset whose endpoint-scoped token should be resolved. */
+    assetId?: number | string;
+    /** Overrides the transport used for the ion endpoint-token exchange. */
+    fetch?: FetchLike;
+    /** Whether the supplied token is account-scoped or already asset-scoped. */
+    tokenType?: 'account' | 'asset' | 'auto';
+};
+/** Creates a Mapbox `access_token` query credential. */
+export declare function createMapboxCredential(options: MapboxCredentialOptions): RequestCredential;
+/** Creates a Google Maps Platform `key` query credential. */
+export declare function createGoogleMapsCredential(options: GoogleMapsCredentialOptions): RequestCredential;
+/**
+ * Creates a bearer credential for the Cesium ion REST API or one Cesium ion asset.
+ *
+ * Supplying `assetId` creates an asset-origin credential. Account tokens are exchanged lazily
+ * through Cesium ion's endpoint API; legacy asset-scoped tokens are used directly. Without an
+ * `assetId`, the credential is scoped only to the ion REST API for backwards compatibility.
+ */
+export declare function createCesiumIonCredential(options: CesiumIonCredentialOptions): RequestCredential;
+//# sourceMappingURL=authentication.d.ts.map

package/dist/authentication.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.d.ts","sourceRoot":"","sources":["../src/authentication.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EACV,SAAS,EACT,iBAAiB,EAEjB,UAAU,EACX,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAEL,mBAAmB,EAGpB,MAAM,0BAA0B,CAAC;AAIlC,sDAAsD;AACtD,qBAAa,oBAAqB,SAAQ,mBAAmB;IAC3D,gDAAgD;IAChD,MAAM,CAAC,QAAQ,CAAC,IAAI,YAAY;IAChC,uEAAuE;gBAC3D,OAAO,EAAE,uBAAuB;CAG7C;AAED,sDAAsD;AACtD,qBAAa,wBAAyB,SAAQ,mBAAmB;IAC/D,gDAAgD;IAChD,MAAM,CAAC,QAAQ,CAAC,IAAI,iBAAiB;IACrC,4EAA4E;gBAChE,OAAO,EAAE,2BAA2B;CAGjD;AAED,kFAAkF;AAClF,qBAAa,uBAAwB,SAAQ,mBAAmB;IAC9D,gDAAgD;IAChD,MAAM,CAAC,QAAQ,CAAC,IAAI,gBAAgB;IACpC,sEAAsE;gBAC1D,OAAO,EAAE,0BAA0B;CAGhD;AAMD,oFAAoF;AACpF,MAAM,MAAM,wBAAwB,GAAG;IACrC,8DAA8D;IAC9D,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;CAC7B,CAAC;AAEF,2CAA2C;AAC3C,MAAM,MAAM,uBAAuB,GAAG,wBAAwB,GAAG;IAC/D,wEAAwE;IACxE,WAAW,EAAE,UAAU,CAAC;CACzB,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,2BAA2B,GAAG,wBAAwB,GAAG;IACnE,wEAAwE;IACxE,MAAM,EAAE,UAAU,CAAC;CACpB,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,0BAA0B,GAAG,wBAAwB,GAAG;IAClE,qEAAqE;IACrE,WAAW,EAAE,UAAU,CAAC;IACxB,qEAAqE;IACrE,OAAO,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC;IAC1B,wEAAwE;IACxE,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,4EAA4E;IAC5E,SAAS,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;CAC1C,CAAC;AAEF,wDAAwD;AACxD,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,GAAG,iBAAiB,CAO1F;AAED,6DAA6D;AAC7D,wBAAgB,0BAA0B,CACxC,OAAO,EAAE,2BAA2B,GACnC,iBAAiB,CAOnB;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,0BAA0B,GAAG,iBAAiB,CAwBhG"}

package/dist/authentication.js

@@ -0,0 +1,136 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+import { createAuthenticatedFetch, TokenAuthentication, createBearerTokenCredential, createQueryParameterCredential } from '@loaders.gl/loader-utils';
+const CESIUM_ION_API_ORIGIN = 'https://api.cesium.com';
+/** Declarative Mapbox access-token authentication. */
+export class MapboxAuthentication extends TokenAuthentication {
+    /** Discriminator used in `core.credentials`. */
+    static type = 'mapbox';
+    /** Creates a Mapbox credential with the existing provider defaults. */
+    constructor(options) {
+        super(createMapboxCredential(options));
+    }
+}
+/** Declarative Google Maps API-key authentication. */
+export class GoogleMapsAuthentication extends TokenAuthentication {
+    /** Discriminator used in `core.credentials`. */
+    static type = 'google-maps';
+    /** Creates a Google Maps credential with the existing provider defaults. */
+    constructor(options) {
+        super(createGoogleMapsCredential(options));
+    }
+}
+/** Declarative Cesium ion authentication, including lazy asset-token exchange. */
+export class CesiumIonAuthentication extends TokenAuthentication {
+    /** Discriminator used in `core.credentials`. */
+    static type = 'cesium-ion';
+    /** Creates an ion credential with the existing provider lifecycle. */
+    constructor(options) {
+        super(createCesiumIonCredential(options));
+    }
+}
+const CESIUM_ION_ASSET_ORIGINS = [
+    'https://assets.ion.cesium.com',
+    'https://assets.cesium.com'
+];
+/** Creates a Mapbox `access_token` query credential. */
+export function createMapboxCredential(options) {
+    return createQueryParameterCredential({
+        id: 'mapbox-access-token',
+        origins: options.origins || ['https://api.mapbox.com'],
+        parameterName: 'access_token',
+        token: options.accessToken
+    });
+}
+/** Creates a Google Maps Platform `key` query credential. */
+export function createGoogleMapsCredential(options) {
+    return createQueryParameterCredential({
+        id: 'google-maps-api-key',
+        origins: options.origins || ['https://tile.googleapis.com'],
+        parameterName: 'key',
+        token: options.apiKey
+    });
+}
+/**
+ * Creates a bearer credential for the Cesium ion REST API or one Cesium ion asset.
+ *
+ * Supplying `assetId` creates an asset-origin credential. Account tokens are exchanged lazily
+ * through Cesium ion's endpoint API; legacy asset-scoped tokens are used directly. Without an
+ * `assetId`, the credential is scoped only to the ion REST API for backwards compatibility.
+ */
+export function createCesiumIonCredential(options) {
+    if (options.assetId === undefined || options.assetId === null) {
+        return createBearerTokenCredential({
+            id: 'cesium-ion-access-token',
+            origins: options.origins || [CESIUM_ION_API_ORIGIN],
+            token: options.accessToken
+        });
+    }
+    const assetId = options.assetId;
+    const origins = options.origins || CESIUM_ION_ASSET_ORIGINS;
+    let endpointTokenPromise = null;
+    return createBearerTokenCredential({
+        id: `cesium-ion-asset-${assetId}`,
+        origins,
+        token: context => {
+            if (context.reason === 'refresh') {
+                endpointTokenPromise = null;
+            }
+            endpointTokenPromise ||= resolveCesiumIonAssetToken(options, assetId, origins, context);
+            return endpointTokenPromise;
+        }
+    });
+}
+/** Resolves an account token and exchanges it for an asset endpoint token when required. */
+async function resolveCesiumIonAssetToken(options, assetId, origins, context) {
+    const endpointURL = `${CESIUM_ION_API_ORIGIN}/v1/assets/${assetId}/endpoint`;
+    const accessToken = typeof options.accessToken === 'function'
+        ? await options.accessToken({ ...context, url: endpointURL })
+        : options.accessToken;
+    if (!accessToken)
+        return null;
+    const tokenType = options.tokenType || 'auto';
+    if (tokenType === 'asset' ||
+        (tokenType === 'auto' && isCesiumIonAssetToken(accessToken, assetId))) {
+        return accessToken;
+    }
+    const apiCredential = createBearerTokenCredential({
+        id: `cesium-ion-api-${assetId}`,
+        origins: [CESIUM_ION_API_ORIGIN],
+        token: accessToken
+    });
+    const ionFetch = createAuthenticatedFetch({
+        fetch: options.fetch,
+        credentials: [apiCredential]
+    });
+    const response = await ionFetch(endpointURL);
+    if (!response.ok) {
+        throw new Error(`Cesium ion asset ${assetId} endpoint request failed: ${response.status}`);
+    }
+    const endpoint = (await response.json());
+    if (typeof endpoint.url !== 'string' || !origins.includes(new URL(endpoint.url).origin)) {
+        throw new Error(`Cesium ion asset ${assetId} resolved to an unconfigured origin.`);
+    }
+    if (typeof endpoint.accessToken !== 'string' || !endpoint.accessToken) {
+        throw new Error(`Cesium ion did not return an endpoint token for asset ${assetId}.`);
+    }
+    return endpoint.accessToken;
+}
+/** Detects legacy JWTs whose claims scope them directly to the requested asset. */
+function isCesiumIonAssetToken(token, assetId) {
+    try {
+        const encodedClaims = token.split('.')[1];
+        if (!encodedClaims)
+            return false;
+        const base64 = encodedClaims.replace(/-/g, '+').replace(/_/g, '/');
+        const paddedBase64 = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+        const claims = JSON.parse(atob(paddedBase64));
+        return (Array.isArray(claims.assets) &&
+            claims.assets.some(claimAssetId => String(claimAssetId) === String(assetId)));
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=authentication.js.map

package/dist/authentication.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"authentication.js","sourceRoot":"","sources":["../src/authentication.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,+BAA+B;AAC/B,oCAAoC;AAQpC,OAAO,EACL,wBAAwB,EACxB,mBAAmB,EACnB,2BAA2B,EAC3B,8BAA8B,EAC/B,MAAM,0BAA0B,CAAC;AAElC,MAAM,qBAAqB,GAAG,wBAAwB,CAAC;AAEvD,sDAAsD;AACtD,MAAM,OAAO,oBAAqB,SAAQ,mBAAmB;IAC3D,gDAAgD;IAChD,MAAM,CAAU,IAAI,GAAG,QAAQ,CAAC;IAChC,uEAAuE;IACvE,YAAY,OAAgC;QAC1C,KAAK,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAC;IACzC,CAAC;;AAGH,sDAAsD;AACtD,MAAM,OAAO,wBAAyB,SAAQ,mBAAmB;IAC/D,gDAAgD;IAChD,MAAM,CAAU,IAAI,GAAG,aAAa,CAAC;IACrC,4EAA4E;IAC5E,YAAY,OAAoC;QAC9C,KAAK,CAAC,0BAA0B,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7C,CAAC;;AAGH,kFAAkF;AAClF,MAAM,OAAO,uBAAwB,SAAQ,mBAAmB;IAC9D,gDAAgD;IAChD,MAAM,CAAU,IAAI,GAAG,YAAY,CAAC;IACpC,sEAAsE;IACtE,YAAY,OAAmC;QAC7C,KAAK,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5C,CAAC;;AAEH,MAAM,wBAAwB,GAAG;IAC/B,+BAA+B;IAC/B,2BAA2B;CACnB,CAAC;AAgCX,wDAAwD;AACxD,MAAM,UAAU,sBAAsB,CAAC,OAAgC;IACrE,OAAO,8BAA8B,CAAC;QACpC,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,wBAAwB,CAAC;QACtD,aAAa,EAAE,cAAc;QAC7B,KAAK,EAAE,OAAO,CAAC,WAAW;KAC3B,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,0BAA0B,CACxC,OAAoC;IAEpC,OAAO,8BAA8B,CAAC;QACpC,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,6BAA6B,CAAC;QAC3D,aAAa,EAAE,KAAK;QACpB,KAAK,EAAE,OAAO,CAAC,MAAM;KACtB,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAmC;IAC3E,IAAI,OAAO,CAAC,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9D,OAAO,2BAA2B,CAAC;YACjC,EAAE,EAAE,yBAAyB;YAC7B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,CAAC,qBAAqB,CAAC;YACnD,KAAK,EAAE,OAAO,CAAC,WAAW;SAC3B,CAAC,CAAC;IACL,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;IAChC,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,wBAAwB,CAAC;IAC5D,IAAI,oBAAoB,GAAkC,IAAI,CAAC;IAE/D,OAAO,2BAA2B,CAAC;QACjC,EAAE,EAAE,oBAAoB,OAAO,EAAE;QACjC,OAAO;QACP,KAAK,EAAE,OAAO,CAAC,EAAE;YACf,IAAI,OAAO,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;gBACjC,oBAAoB,GAAG,IAAI,CAAC;YAC9B,CAAC;YACD,oBAAoB,KAAK,0BAA0B,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;YACxF,OAAO,oBAAoB,CAAC;QAC9B,CAAC;KACF,CAAC,CAAC;AACL,CAAC;AAED,4FAA4F;AAC5F,KAAK,UAAU,0BAA0B,CACvC,OAAmC,EACnC,OAAwB,EACxB,OAA0B,EAC1B,OAA6B;IAE7B,MAAM,WAAW,GAAG,GAAG,qBAAqB,cAAc,OAAO,WAAW,CAAC;IAC7E,MAAM,WAAW,GACf,OAAO,OAAO,CAAC,WAAW,KAAK,UAAU;QACvC,CAAC,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,EAAC,GAAG,OAAO,EAAE,GAAG,EAAE,WAAW,EAAC,CAAC;QAC3D,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC;IAC1B,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAE9B,MAAM,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC;IAC9C,IACE,SAAS,KAAK,OAAO;QACrB,CAAC,SAAS,KAAK,MAAM,IAAI,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,EACrE,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,aAAa,GAAG,2BAA2B,CAAC;QAChD,EAAE,EAAE,kBAAkB,OAAO,EAAE;QAC/B,OAAO,EAAE,CAAC,qBAAqB,CAAC;QAChC,KAAK,EAAE,WAAW;KACnB,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,wBAAwB,CAAC;QACxC,KAAK,EAAE,OAAO,CAAC,KAAK;QACpB,WAAW,EAAE,CAAC,aAAa,CAAC;KAC7B,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,MAAM,QAAQ,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,6BAA6B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAC7F,CAAC;IAED,MAAM,QAAQ,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAA2C,CAAC;IACnF,IAAI,OAAO,QAAQ,CAAC,GAAG,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,KAAK,CAAC,oBAAoB,OAAO,sCAAsC,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,OAAO,QAAQ,CAAC,WAAW,KAAK,QAAQ,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC;QACtE,MAAM,IAAI,KAAK,CAAC,yDAAyD,OAAO,GAAG,CAAC,CAAC;IACvF,CAAC;IACD,OAAO,QAAQ,CAAC,WAAW,CAAC;AAC9B,CAAC;AAED,mFAAmF;AACnF,SAAS,qBAAqB,CAAC,KAAa,EAAE,OAAwB;IACpE,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1C,IAAI,CAAC,aAAa;YAAE,OAAO,KAAK,CAAC;QACjC,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QACnE,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,CAAuB,CAAC;QACpE,OAAO,CACL,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;YAC5B,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,CAAC,CAC7E,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/bundled.d.ts

@@ -0,0 +1,2 @@
+export * from "./index.js";
+//# sourceMappingURL=bundled.d.ts.map

package/dist/bundled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled.d.ts","sourceRoot":"","sources":["../src/bundled.ts"],"names":[],"mappings":"AAKA,2BAAwB"}

package/dist/bundled.js

@@ -0,0 +1,6 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+// ArcGIS sources have no parser-only implementation to defer.
+export * from "./index.js";
+//# sourceMappingURL=bundled.js.map

package/dist/bundled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled.js","sourceRoot":"","sources":["../src/bundled.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,+BAA+B;AAC/B,oCAAoC;AAEpC,8DAA8D;AAC9D,2BAAwB"}

package/dist/index.cjs

@@ -0,0 +1,454 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// dist/index.js
+var index_exports = {};
+__export(index_exports, {
+  CesiumIonAuthentication: () => CesiumIonAuthentication,
+  GoogleMapsAuthentication: () => GoogleMapsAuthentication,
+  MapboxAuthentication: () => MapboxAuthentication,
+  createCesiumIonCredential: () => createCesiumIonCredential,
+  createGoogleMapsCredential: () => createGoogleMapsCredential,
+  createMapboxCredential: () => createMapboxCredential
+});
+module.exports = __toCommonJS(index_exports);
+
+// ../loader-utils/src/lib/request-utils/authentication.ts
+function resolveCredentials(credentials, authentications = []) {
+  if (credentials.every(isAuthentication)) return credentials;
+  return credentials.map((credential, index) => {
+    if (isAuthentication(credential)) return credential;
+    const AuthenticationClass = authentications.find(
+      (authentication2) => authentication2.type === (credential == null ? void 0 : credential.type)
+    );
+    if (!AuthenticationClass) {
+      throw new Error(`No authentication class registered for credential at index ${index}.`);
+    }
+    let authentication;
+    try {
+      authentication = new AuthenticationClass(credential);
+    } catch {
+      throw new Error(`Invalid authentication configuration at index ${index}.`);
+    }
+    if (!isAuthentication(authentication)) {
+      throw new Error(`Authentication class returned an invalid credential at index ${index}.`);
+    }
+    return authentication;
+  });
+}
+function isAuthentication(credential) {
+  if (!credential || typeof credential !== "object") return false;
+  if (typeof credential.id !== "string" || !Array.isArray(credential.origins)) return false;
+  if (credential.type === "request") return typeof credential.authenticate === "function";
+  return (credential.type === "header" || credential.type === "query-parameter") && typeof credential.name === "string" && (typeof credential.token === "string" || typeof credential.token === "function") && Array.isArray(credential.refreshStatusCodes);
+}
+
+// ../loader-utils/src/lib/request-utils/request-credentials.ts
+var DEFAULT_REFRESH_STATUS_CODES = [401, 403];
+var AUTHENTICATED_FETCH = /* @__PURE__ */ Symbol("loaders.gl.authenticated-fetch");
+var refreshPromises = /* @__PURE__ */ new WeakMap();
+function createQueryParameterCredential(options) {
+  return {
+    id: options.id,
+    origins: normalizeOrigins(options.origins),
+    type: "query-parameter",
+    name: options.parameterName,
+    token: options.token,
+    refreshStatusCodes: options.refreshStatusCodes || DEFAULT_REFRESH_STATUS_CODES
+  };
+}
+function createBearerTokenCredential(options) {
+  return {
+    id: options.id,
+    origins: normalizeOrigins(options.origins),
+    type: "header",
+    name: options.headerName || "Authorization",
+    prefix: options.prefix ?? "Bearer ",
+    token: options.token,
+    refreshStatusCodes: options.refreshStatusCodes || DEFAULT_REFRESH_STATUS_CODES
+  };
+}
+var TokenAuthentication = class {
+  /** Stable identifier used in diagnostics. */
+  id;
+  /** Exact origins authorized to receive the token. */
+  origins;
+  /** Transport placement of the token. */
+  type;
+  /** Header or query parameter name. */
+  name;
+  /** Optional prefix for header values. */
+  prefix;
+  /** Static token or application-managed token provider. */
+  token;
+  /** Statuses that permit one refresh and replay. */
+  refreshStatusCodes;
+  /** Provider-specific response failure detection. */
+  shouldRefresh;
+  /** Provider-specific read-only request replay predicate. */
+  canReplayRequest;
+  /** Initializes the instance from an existing transport credential. */
+  constructor(credential) {
+    this.id = credential.id;
+    this.origins = credential.origins;
+    this.type = credential.type;
+    this.name = credential.name;
+    this.prefix = credential.prefix;
+    this.token = credential.token;
+    this.refreshStatusCodes = credential.refreshStatusCodes;
+    this.shouldRefresh = credential.shouldRefresh;
+    this.canReplayRequest = credential.canReplayRequest;
+  }
+};
+function createAuthenticatedFetch(options) {
+  const suppliedFetch = options.fetch || ((url, requestOptions) => fetch(url, requestOptions));
+  const existingMetadata = suppliedFetch[AUTHENTICATED_FETCH];
+  const credentialResolutions = new Map(existingMetadata == null ? void 0 : existingMetadata.credentialResolutions);
+  const resolvedCredentials = resolveCredentials(
+    options.credentials.map((credential) => credentialResolutions.get(credential) || credential),
+    options.authentications
+  );
+  options.credentials.forEach((credential, index) => {
+    credentialResolutions.set(credential, resolvedCredentials[index]);
+  });
+  if (!options.fetchOptions && (!resolvedCredentials.length || (existingMetadata == null ? void 0 : existingMetadata.credentials.length) === resolvedCredentials.length && resolvedCredentials.every(
+    (credential, index) => credential === existingMetadata.credentials[index]
+  )))
+    return suppliedFetch;
+  const baseFetch = (existingMetadata == null ? void 0 : existingMetadata.fetch) || suppliedFetch;
+  const credentials = existingMetadata ? [.../* @__PURE__ */ new Set([...resolvedCredentials, ...existingMetadata.credentials])] : resolvedCredentials;
+  const fetchOptions = mergeFetchOptions(
+    (existingMetadata == null ? void 0 : existingMetadata.fetchOptions) || {},
+    options.fetchOptions
+  );
+  const tokenCredentials = credentials.filter(
+    (credential) => credential.type !== "request"
+  );
+  const requestCredentials = credentials.filter(
+    (credential) => credential.type === "request"
+  );
+  for (const credential of requestCredentials) normalizeRequestOrigins(credential.origins);
+  const authenticatedFetch = async (url, requestOptions = {}) => {
+    var _a, _b, _c, _d, _e, _f, _g;
+    requestOptions = mergeFetchOptions(fetchOptions, requestOptions);
+    if ((_a = requestOptions.signal) == null ? void 0 : _a.aborted) throw createAbortError();
+    if (!credentials.length) return baseFetch(url, requestOptions);
+    const resolvedURL = parseHTTPURL(url);
+    const authorization = resolvedURL ? await authorizeRequest(resolvedURL, requestOptions, tokenCredentials) : { url, options: requestOptions, credentials: [] };
+    const signedRequest = await authenticateRequest(authorization, requestCredentials, "request");
+    const response = await baseFetch(signedRequest.url, signedRequest.options);
+    const refreshableCredentials = [];
+    for (const resolvedCredential of authorization.credentials) {
+      const { credential } = resolvedCredential;
+      if (typeof credential.token === "function" && (isReplayableRequest(requestOptions) || ((_b = credential.canReplayRequest) == null ? void 0 : _b.call(credential, url, requestOptions))) && (isReplayableRequest(signedRequest.options) || ((_c = credential.canReplayRequest) == null ? void 0 : _c.call(credential, signedRequest.url, signedRequest.options))) && (credential.refreshStatusCodes.includes(response.status) || await ((_d = credential.shouldRefresh) == null ? void 0 : _d.call(credential, response))))
+        refreshableCredentials.push(resolvedCredential);
+    }
+    const shouldRetrySignature = isReplayableRequest(requestOptions) && isReplayableRequest(signedRequest.options) && signedRequest.credentials.some(
+      (credential) => {
+        var _a2;
+        return (_a2 = credential.refreshStatusCodes) == null ? void 0 : _a2.includes(response.status);
+      }
+    );
+    if (!refreshableCredentials.length && !shouldRetrySignature) return response;
+    if ((_e = requestOptions.signal) == null ? void 0 : _e.aborted) throw createAbortError();
+    const refreshedTokens = /* @__PURE__ */ new Map();
+    await Promise.all(
+      refreshableCredentials.map(async ({ credential }) => {
+        const token = await refreshCredential(credential, url, response);
+        if (token) refreshedTokens.set(credential, token);
+      })
+    );
+    if (!refreshedTokens.size && !shouldRetrySignature) return response;
+    await ((_f = response.body) == null ? void 0 : _f.cancel().catch(() => {
+    }));
+    if ((_g = requestOptions.signal) == null ? void 0 : _g.aborted) throw createAbortError();
+    const replayAuthorization = resolvedURL ? await authorizeRequest(
+      resolvedURL,
+      requestOptions,
+      tokenCredentials,
+      refreshedTokens,
+      authorization.credentials
+    ) : { url, options: requestOptions };
+    const replayRequest = await authenticateRequest(
+      replayAuthorization,
+      requestCredentials,
+      "retry",
+      response
+    );
+    return baseFetch(replayRequest.url, replayRequest.options);
+  };
+  Object.defineProperty(authenticatedFetch, AUTHENTICATED_FETCH, {
+    value: {
+      fetch: baseFetch,
+      credentials,
+      credentialResolutions,
+      fetchOptions
+    }
+  });
+  return authenticatedFetch;
+}
+function mergeFetchOptions(defaultOptions, requestOptions) {
+  const mergedOptions = { ...defaultOptions, ...requestOptions };
+  if (defaultOptions.headers || (requestOptions == null ? void 0 : requestOptions.headers)) {
+    const headers = new Headers(defaultOptions.headers);
+    new Headers(requestOptions == null ? void 0 : requestOptions.headers).forEach((value, key) => headers.set(key, value));
+    mergedOptions.headers = headers;
+  }
+  return mergedOptions;
+}
+async function authenticateRequest(request, credentials, reason, response) {
+  const appliedCredentials = [];
+  const signal = request.options.signal;
+  for (const credential of credentials) {
+    const origin = getRequestOrigin(request.url);
+    if (!origin || !normalizeRequestOrigins(credential.origins).includes(origin)) continue;
+    if (signal == null ? void 0 : signal.aborted) throw createAbortError();
+    const authenticatedRequest = await credential.authenticate({
+      url: request.url,
+      options: { ...request.options, headers: new Headers(request.options.headers) },
+      reason,
+      response: response ? { status: response.status, headers: new Headers(response.headers) } : void 0
+    });
+    if (!authenticatedRequest || typeof authenticatedRequest.url !== "string" || !authenticatedRequest.options || typeof authenticatedRequest.options !== "object") {
+      throw new Error("Authentication callback returned an invalid request.");
+    }
+    request = {
+      url: authenticatedRequest.url,
+      options: { ...authenticatedRequest.options, ...signal ? { signal } : {} }
+    };
+    appliedCredentials.push(credential);
+  }
+  if (signal == null ? void 0 : signal.aborted) throw createAbortError();
+  return { ...request, credentials: appliedCredentials };
+}
+function getRequestOrigin(url) {
+  try {
+    const parsedURL = new URL(url);
+    if (!parsedURL.host || parsedURL.username || parsedURL.password) return null;
+    return parsedURL.origin !== "null" ? parsedURL.origin : `${parsedURL.protocol}//${parsedURL.host}`;
+  } catch {
+    return null;
+  }
+}
+function normalizeRequestOrigins(origins) {
+  if (!origins.length)
+    throw new Error("Request authentication requires at least one exact origin.");
+  return origins.map((origin) => {
+    const resolvedOrigin = getRequestOrigin(origin);
+    let url;
+    try {
+      url = new URL(origin);
+    } catch {
+      throw new Error("Invalid request authentication origin.");
+    }
+    if (!resolvedOrigin || url.pathname && url.pathname !== "/" || url.search || url.hash) {
+      throw new Error("Invalid request authentication origin.");
+    }
+    return resolvedOrigin;
+  });
+}
+async function authorizeRequest(sourceURL, requestOptions, credentials, tokenOverrides = /* @__PURE__ */ new Map(), previousCredentials = []) {
+  const url = new URL(sourceURL);
+  const headers = new Headers(requestOptions.headers);
+  const resolvedCredentials = [];
+  const previousTokens = new Map(
+    previousCredentials.map(({ credential, token }) => [credential, token])
+  );
+  for (const credential of credentials) {
+    if (!credential.origins.includes(url.origin)) continue;
+    const overrideToken = tokenOverrides.get(credential);
+    const previousToken = previousTokens.get(credential);
+    const ownsQueryParameter = credential.type === "query-parameter" && previousToken !== void 0;
+    const ownsHeader = credential.type === "header" && previousToken !== void 0;
+    if (credential.type === "query-parameter" && url.searchParams.has(credential.name) && !ownsQueryParameter || credential.type === "header" && headers.has(credential.name) && !ownsHeader) {
+      continue;
+    }
+    const token = overrideToken ?? previousToken ?? await resolveToken(credential.token, { url: sourceURL.toString(), reason: "request" });
+    if (!token) continue;
+    if (credential.type === "query-parameter") {
+      url.searchParams.set(credential.name, token);
+    } else {
+      headers.set(credential.name, `${credential.prefix || ""}${token}`);
+    }
+    resolvedCredentials.push({ credential, token });
+  }
+  return {
+    url: url.toString(),
+    options: { ...requestOptions, headers },
+    credentials: resolvedCredentials
+  };
+}
+async function refreshCredential(credential, url, response) {
+  const existingPromise = refreshPromises.get(credential);
+  if (existingPromise) return existingPromise;
+  const tokenProvider = credential.token;
+  const promise = Promise.resolve(
+    tokenProvider({
+      url,
+      reason: "refresh",
+      response: { status: response.status, headers: response.headers }
+    })
+  ).finally(() => refreshPromises.delete(credential));
+  refreshPromises.set(credential, promise);
+  return promise;
+}
+async function resolveToken(token, context) {
+  return typeof token === "function" ? token(context) : token;
+}
+function normalizeOrigins(origins) {
+  if (!origins.length) throw new Error("Request credentials require at least one exact origin.");
+  return origins.map((origin) => {
+    const url = new URL(origin);
+    if (!["http:", "https:"].includes(url.protocol) || url.pathname !== "/" || url.search || url.hash) {
+      throw new Error(`Credential origin must contain only scheme, host, and port: ${origin}`);
+    }
+    return url.origin;
+  });
+}
+function parseHTTPURL(url) {
+  try {
+    const parsedURL = new URL(url);
+    return ["http:", "https:"].includes(parsedURL.protocol) ? parsedURL : null;
+  } catch {
+    return null;
+  }
+}
+function isReplayableRequest(options) {
+  const method = (options.method || "GET").toUpperCase();
+  if (!["GET", "HEAD", "OPTIONS", "PUT", "DELETE"].includes(method)) return false;
+  return !(options.body && typeof ReadableStream !== "undefined" && options.body instanceof ReadableStream);
+}
+function createAbortError() {
+  return new DOMException("The operation was aborted.", "AbortError");
+}
+
+// dist/authentication.js
+var CESIUM_ION_API_ORIGIN = "https://api.cesium.com";
+var MapboxAuthentication = class extends TokenAuthentication {
+  /** Discriminator used in `core.credentials`. */
+  static type = "mapbox";
+  /** Creates a Mapbox credential with the existing provider defaults. */
+  constructor(options) {
+    super(createMapboxCredential(options));
+  }
+};
+var GoogleMapsAuthentication = class extends TokenAuthentication {
+  /** Discriminator used in `core.credentials`. */
+  static type = "google-maps";
+  /** Creates a Google Maps credential with the existing provider defaults. */
+  constructor(options) {
+    super(createGoogleMapsCredential(options));
+  }
+};
+var CesiumIonAuthentication = class extends TokenAuthentication {
+  /** Discriminator used in `core.credentials`. */
+  static type = "cesium-ion";
+  /** Creates an ion credential with the existing provider lifecycle. */
+  constructor(options) {
+    super(createCesiumIonCredential(options));
+  }
+};
+var CESIUM_ION_ASSET_ORIGINS = [
+  "https://assets.ion.cesium.com",
+  "https://assets.cesium.com"
+];
+function createMapboxCredential(options) {
+  return createQueryParameterCredential({
+    id: "mapbox-access-token",
+    origins: options.origins || ["https://api.mapbox.com"],
+    parameterName: "access_token",
+    token: options.accessToken
+  });
+}
+function createGoogleMapsCredential(options) {
+  return createQueryParameterCredential({
+    id: "google-maps-api-key",
+    origins: options.origins || ["https://tile.googleapis.com"],
+    parameterName: "key",
+    token: options.apiKey
+  });
+}
+function createCesiumIonCredential(options) {
+  if (options.assetId === void 0 || options.assetId === null) {
+    return createBearerTokenCredential({
+      id: "cesium-ion-access-token",
+      origins: options.origins || [CESIUM_ION_API_ORIGIN],
+      token: options.accessToken
+    });
+  }
+  const assetId = options.assetId;
+  const origins = options.origins || CESIUM_ION_ASSET_ORIGINS;
+  let endpointTokenPromise = null;
+  return createBearerTokenCredential({
+    id: `cesium-ion-asset-${assetId}`,
+    origins,
+    token: (context) => {
+      if (context.reason === "refresh") {
+        endpointTokenPromise = null;
+      }
+      endpointTokenPromise ||= resolveCesiumIonAssetToken(options, assetId, origins, context);
+      return endpointTokenPromise;
+    }
+  });
+}
+async function resolveCesiumIonAssetToken(options, assetId, origins, context) {
+  const endpointURL = `${CESIUM_ION_API_ORIGIN}/v1/assets/${assetId}/endpoint`;
+  const accessToken = typeof options.accessToken === "function" ? await options.accessToken({ ...context, url: endpointURL }) : options.accessToken;
+  if (!accessToken)
+    return null;
+  const tokenType = options.tokenType || "auto";
+  if (tokenType === "asset" || tokenType === "auto" && isCesiumIonAssetToken(accessToken, assetId)) {
+    return accessToken;
+  }
+  const apiCredential = createBearerTokenCredential({
+    id: `cesium-ion-api-${assetId}`,
+    origins: [CESIUM_ION_API_ORIGIN],
+    token: accessToken
+  });
+  const ionFetch = createAuthenticatedFetch({
+    fetch: options.fetch,
+    credentials: [apiCredential]
+  });
+  const response = await ionFetch(endpointURL);
+  if (!response.ok) {
+    throw new Error(`Cesium ion asset ${assetId} endpoint request failed: ${response.status}`);
+  }
+  const endpoint = await response.json();
+  if (typeof endpoint.url !== "string" || !origins.includes(new URL(endpoint.url).origin)) {
+    throw new Error(`Cesium ion asset ${assetId} resolved to an unconfigured origin.`);
+  }
+  if (typeof endpoint.accessToken !== "string" || !endpoint.accessToken) {
+    throw new Error(`Cesium ion did not return an endpoint token for asset ${assetId}.`);
+  }
+  return endpoint.accessToken;
+}
+function isCesiumIonAssetToken(token, assetId) {
+  try {
+    const encodedClaims = token.split(".")[1];
+    if (!encodedClaims)
+      return false;
+    const base64 = encodedClaims.replace(/-/g, "+").replace(/_/g, "/");
+    const paddedBase64 = base64.padEnd(Math.ceil(base64.length / 4) * 4, "=");
+    const claims = JSON.parse(atob(paddedBase64));
+    return Array.isArray(claims.assets) && claims.assets.some((claimAssetId) => String(claimAssetId) === String(assetId));
+  } catch {
+    return false;
+  }
+}
+//# sourceMappingURL=index.cjs.map

package/dist/index.cjs.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../src/index.ts", "../../loader-utils/src/lib/request-utils/authentication.ts", "../../loader-utils/src/lib/request-utils/request-credentials.ts", "../src/authentication.ts"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;AAAA;;;;;;;;;;;;ACiEO,SAAS,mBACd,aACA,kBAAwD,CAAC,GAC9B;AAC3B,MAAI,YAAY,MAAM,gBAAgB,EAAG,QAAO;AAChD,SAAO,YAAY,IAAI,CAAC,YAAY,UAAU;AAC5C,QAAI,iBAAiB,UAAU,EAAG,QAAO;AACzC,UAAM,sBAAsB,gBAAgB;AAAA,MAC1C,CAAAA,oBAAkBA,gBAAe,UAAS,yCAAY;AAAA,IACxD;AACA,QAAI,CAAC,qBAAqB;AACxB,YAAM,IAAI,MAAM,8DAA8D,KAAK,GAAG;AAAA,IACxF;AACA,QAAI;AACJ,QAAI;AACF,uBAAiB,IAAI,oBAAoB,UAAU;AAAA,IACrD,QAAQ;AAEN,YAAM,IAAI,MAAM,iDAAiD,KAAK,GAAG;AAAA,IAC3E;AACA,QAAI,CAAC,iBAAiB,cAAc,GAAG;AACrC,YAAM,IAAI,MAAM,gEAAgE,KAAK,GAAG;AAAA,IAC1F;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAiCA,SAAS,iBAAiB,YAAsD;AAC9E,MAAI,CAAC,cAAc,OAAO,eAAe,SAAU,QAAO;AAC1D,MAAI,OAAO,WAAW,OAAO,YAAY,CAAC,MAAM,QAAQ,WAAW,OAAO,EAAG,QAAO;AACpF,MAAI,WAAW,SAAS,UAAW,QAAO,OAAO,WAAW,iBAAiB;AAC7E,UACG,WAAW,SAAS,YAAY,WAAW,SAAS,sBACrD,OAAO,WAAW,SAAS,aAC1B,OAAO,WAAW,UAAU,YAAY,OAAO,WAAW,UAAU,eACrE,MAAM,QAAQ,WAAW,kBAAkB;AAE/C;;;ACvBA,IAAM,+BAA+B,CAAC,KAAK,GAAG;AAC9C,IAAM,sBAAsB,uBAAO,gCAAgC;AACnE,IAAM,kBAAkB,oBAAI,QAAmD;AAexE,SAAS,+BACd,SACmB;AACnB,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,SAAS,iBAAiB,QAAQ,OAAO;AAAA,IACzC,MAAM;AAAA,IACN,MAAM,QAAQ;AAAA,IACd,OAAO,QAAQ;AAAA,IACf,oBAAoB,QAAQ,sBAAsB;AAAA,EACpD;AACF;AAGO,SAAS,4BACd,SACmB;AACnB,SAAO;AAAA,IACL,IAAI,QAAQ;AAAA,IACZ,SAAS,iBAAiB,QAAQ,OAAO;AAAA,IACzC,MAAM;AAAA,IACN,MAAM,QAAQ,cAAc;AAAA,IAC5B,QAAQ,QAAQ,UAAU;AAAA,IAC1B,OAAO,QAAQ;AAAA,IACf,oBAAoB,QAAQ,sBAAsB;AAAA,EACpD;AACF;AAGO,IAAM,sBAAN,MAAuD;AAAA;AAAA,EAEnD;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAEA;AAAA;AAAA,EAGA;AAAA;AAAA,EAEA;AAAA;AAAA,EAGT,YAAY,YAA+B;AACzC,SAAK,KAAK,WAAW;AACrB,SAAK,UAAU,WAAW;AAC1B,SAAK,OAAO,WAAW;AACvB,SAAK,OAAO,WAAW;AACvB,SAAK,SAAS,WAAW;AACzB,SAAK,QAAQ,WAAW;AACxB,SAAK,qBAAqB,WAAW;AACrC,SAAK,gBAAgB,WAAW;AAChC,SAAK,mBAAmB,WAAW;AAAA,EACrC;AACF;AAyBO,SAAS,yBAAyB,SAA+C;AACtF,QAAM,gBAAgB,QAAQ,UAAU,CAAC,KAAK,mBAAmB,MAAM,KAAK,cAAc;AAC1F,QAAM,mBACJ,cACA,mBAAmB;AACrB,QAAM,wBAAwB,IAAI,IAAI,qDAAkB,qBAAqB;AAC7E,QAAM,sBAAsB;AAAA,IAC1B,QAAQ,YAAY,IAAI,gBAAc,sBAAsB,IAAI,UAAU,KAAK,UAAU;AAAA,IACzF,QAAQ;AAAA,EACV;AACA,UAAQ,YAAY,QAAQ,CAAC,YAAY,UAAU;AACjD,0BAAsB,IAAI,YAAY,oBAAoB,KAAK,CAAC;AAAA,EAClE,CAAC;AACD,MACE,CAAC,QAAQ,iBACR,CAAC,oBAAoB,WACnB,qDAAkB,YAAY,YAAW,oBAAoB,UAC5D,oBAAoB;AAAA,IAClB,CAAC,YAAY,UAAU,eAAe,iBAAiB,YAAY,KAAK;AAAA,EAC1E;AAEJ,WAAO;AACT,QAAM,aAAY,qDAAkB,UAAS;AAC7C,QAAM,cAAc,mBAChB,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,qBAAqB,GAAG,iBAAiB,WAAW,CAAC,CAAC,IACtE;AACJ,QAAM,eAAe;AAAA,KACnB,qDAAkB,iBAAgB,CAAC;AAAA,IACnC,QAAQ;AAAA,EACV;AACA,QAAM,mBAAmB,YAAY;AAAA,IACnC,CAAC,eAAgD,WAAW,SAAS;AAAA,EACvE;AACA,QAAM,qBAAqB,YAAY;AAAA,IACrC,CAAC,eAAoD,WAAW,SAAS;AAAA,EAC3E;AAEA,aAAW,cAAc,mBAAoB,yBAAwB,WAAW,OAAO;AAEvF,QAAM,qBAAgC,OAAO,KAAK,iBAAiB,CAAC,MAAM;AA7P5E;AA8PI,qBAAiB,kBAAkB,cAAc,cAAc;AAC/D,SAAI,oBAAe,WAAf,mBAAuB,QAAS,OAAM,iBAAiB;AAE3D,QAAI,CAAC,YAAY,OAAQ,QAAO,UAAU,KAAK,cAAc;AAC7D,UAAM,cAAc,aAAa,GAAG;AACpC,UAAM,gBAAgB,cAClB,MAAM,iBAAiB,aAAa,gBAAgB,gBAAgB,IACpE,EAAC,KAAK,SAAS,gBAAgB,aAAa,CAAC,EAAC;AAClD,UAAM,gBAAgB,MAAM,oBAAoB,eAAe,oBAAoB,SAAS;AAC5F,UAAM,WAAW,MAAM,UAAU,cAAc,KAAK,cAAc,OAAO;AACzE,UAAM,yBAA+C,CAAC;AACtD,eAAW,sBAAsB,cAAc,aAAa;AAC1D,YAAM,EAAC,WAAU,IAAI;AACrB,UACE,OAAO,WAAW,UAAU,eAC3B,oBAAoB,cAAc,OACjC,gBAAW,qBAAX,oCAA8B,KAAK,sBACpC,oBAAoB,cAAc,OAAO,OACxC,gBAAW,qBAAX,oCAA8B,cAAc,KAAK,cAAc,eAChE,WAAW,mBAAmB,SAAS,SAAS,MAAM,KACpD,QAAM,gBAAW,kBAAX,oCAA2B;AAEpC,+BAAuB,KAAK,kBAAkB;AAAA,IAClD;AACA,UAAM,uBACJ,oBAAoB,cAAc,KAClC,oBAAoB,cAAc,OAAO,KACzC,cAAc,YAAY;AAAA,MAAK,gBAAW;AAzRhD,YAAAC;AA0RQ,gBAAAA,MAAA,WAAW,uBAAX,gBAAAA,IAA+B,SAAS,SAAS;AAAA;AAAA,IACnD;AACF,QAAI,CAAC,uBAAuB,UAAU,CAAC,qBAAsB,QAAO;AACpE,SAAI,oBAAe,WAAf,mBAAuB,QAAS,OAAM,iBAAiB;AAE3D,UAAM,kBAAkB,oBAAI,IAA+B;AAC3D,UAAM,QAAQ;AAAA,MACZ,uBAAuB,IAAI,OAAO,EAAC,WAAU,MAAM;AACjD,cAAM,QAAQ,MAAM,kBAAkB,YAAY,KAAK,QAAQ;AAC/D,YAAI,MAAO,iBAAgB,IAAI,YAAY,KAAK;AAAA,MAClD,CAAC;AAAA,IACH;AACA,QAAI,CAAC,gBAAgB,QAAQ,CAAC,qBAAsB,QAAO;AAE3D,YAAM,cAAS,SAAT,mBAAe,SAAS,MAAM,MAAM;AAAA,IAAC;AAC3C,SAAI,oBAAe,WAAf,mBAAuB,QAAS,OAAM,iBAAiB;AAC3D,UAAM,sBAAsB,cACxB,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,cAAc;AAAA,IAChB,IACA,EAAC,KAAK,SAAS,eAAc;AACjC,UAAM,gBAAgB,MAAM;AAAA,MAC1B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,WAAO,UAAU,cAAc,KAAK,cAAc,OAAO;AAAA,EAC3D;AAEA,SAAO,eAAe,oBAAoB,qBAAqB;AAAA,IAC7D,OAAO;AAAA,MACL,OAAO;AAAA,MACP;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO;AACT;AA0BA,SAAS,kBAAkB,gBAA6B,gBAA2C;AACjG,QAAM,gBAAgB,EAAC,GAAG,gBAAgB,GAAG,eAAc;AAC3D,MAAI,eAAe,YAAW,iDAAgB,UAAS;AACrD,UAAM,UAAU,IAAI,QAAQ,eAAe,OAAO;AAClD,QAAI,QAAQ,iDAAgB,OAAO,EAAE,QAAQ,CAAC,OAAO,QAAQ,QAAQ,IAAI,KAAK,KAAK,CAAC;AACpF,kBAAc,UAAU;AAAA,EAC1B;AACA,SAAO;AACT;AA2BA,eAAe,oBACb,SACA,aACA,QACA,UACoF;AACpF,QAAM,qBAA8C,CAAC;AACrD,QAAM,SAAS,QAAQ,QAAQ;AAC/B,aAAW,cAAc,aAAa;AACpC,UAAM,SAAS,iBAAiB,QAAQ,GAAG;AAC3C,QAAI,CAAC,UAAU,CAAC,wBAAwB,WAAW,OAAO,EAAE,SAAS,MAAM,EAAG;AAC9E,QAAI,iCAAQ,QAAS,OAAM,iBAAiB;AAC5C,UAAM,uBAAuB,MAAM,WAAW,aAAa;AAAA,MACzD,KAAK,QAAQ;AAAA,MACb,SAAS,EAAC,GAAG,QAAQ,SAAS,SAAS,IAAI,QAAQ,QAAQ,QAAQ,OAAO,EAAC;AAAA,MAC3E;AAAA,MACA,UAAU,WACN,EAAC,QAAQ,SAAS,QAAQ,SAAS,IAAI,QAAQ,SAAS,OAAO,EAAC,IAChE;AAAA,IACN,CAAC;AACD,QACE,CAAC,wBACD,OAAO,qBAAqB,QAAQ,YACpC,CAAC,qBAAqB,WACtB,OAAO,qBAAqB,YAAY,UACxC;AACA,YAAM,IAAI,MAAM,sDAAsD;AAAA,IACxE;AACA,cAAU;AAAA,MACR,KAAK,qBAAqB;AAAA,MAC1B,SAAS,EAAC,GAAG,qBAAqB,SAAS,GAAI,SAAS,EAAC,OAAM,IAAI,CAAC,EAAE;AAAA,IACxE;AACA,uBAAmB,KAAK,UAAU;AAAA,EACpC;AACA,MAAI,iCAAQ,QAAS,OAAM,iBAAiB;AAC5C,SAAO,EAAC,GAAG,SAAS,aAAa,mBAAkB;AACrD;AAGA,SAAS,iBAAiB,KAA4B;AACpD,MAAI;AACF,UAAM,YAAY,IAAI,IAAI,GAAG;AAC7B,QAAI,CAAC,UAAU,QAAQ,UAAU,YAAY,UAAU,SAAU,QAAO;AACxE,WAAO,UAAU,WAAW,SACxB,UAAU,SACV,GAAG,UAAU,QAAQ,KAAK,UAAU,IAAI;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,wBAAwB,SAAsC;AACrE,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI,MAAM,4DAA4D;AAC9E,SAAO,QAAQ,IAAI,YAAU;AAC3B,UAAM,iBAAiB,iBAAiB,MAAM;AAC9C,QAAI;AACJ,QAAI;AACF,YAAM,IAAI,IAAI,MAAM;AAAA,IACtB,QAAQ;AACN,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AACA,QAAI,CAAC,kBAAmB,IAAI,YAAY,IAAI,aAAa,OAAQ,IAAI,UAAU,IAAI,MAAM;AACvF,YAAM,IAAI,MAAM,wCAAwC;AAAA,IAC1D;AACA,WAAO;AAAA,EACT,CAAC;AACH;AAGA,eAAe,iBACb,WACA,gBACA,aACA,iBAAyD,oBAAI,IAAI,GACjE,sBAAqD,CAAC,GAC2B;AACjF,QAAM,MAAM,IAAI,IAAI,SAAS;AAC7B,QAAM,UAAU,IAAI,QAAQ,eAAe,OAAO;AAClD,QAAM,sBAA4C,CAAC;AACnD,QAAM,iBAAiB,IAAI;AAAA,IACzB,oBAAoB,IAAI,CAAC,EAAC,YAAY,MAAK,MAAM,CAAC,YAAY,KAAK,CAAU;AAAA,EAC/E;AAEA,aAAW,cAAc,aAAa;AACpC,QAAI,CAAC,WAAW,QAAQ,SAAS,IAAI,MAAM,EAAG;AAC9C,UAAM,gBAAgB,eAAe,IAAI,UAAU;AACnD,UAAM,gBAAgB,eAAe,IAAI,UAAU;AACnD,UAAM,qBAAqB,WAAW,SAAS,qBAAqB,kBAAkB;AACtF,UAAM,aAAa,WAAW,SAAS,YAAY,kBAAkB;AACrE,QACG,WAAW,SAAS,qBACnB,IAAI,aAAa,IAAI,WAAW,IAAI,KACpC,CAAC,sBACF,WAAW,SAAS,YAAY,QAAQ,IAAI,WAAW,IAAI,KAAK,CAAC,YAClE;AACA;AAAA,IACF;AACA,UAAM,QACJ,iBACA,iBACC,MAAM,aAAa,WAAW,OAAO,EAAC,KAAK,UAAU,SAAS,GAAG,QAAQ,UAAS,CAAC;AACtF,QAAI,CAAC,MAAO;AAEZ,QAAI,WAAW,SAAS,mBAAmB;AACzC,UAAI,aAAa,IAAI,WAAW,MAAM,KAAK;AAAA,IAC7C,OAAO;AACL,cAAQ,IAAI,WAAW,MAAM,GAAG,WAAW,UAAU,EAAE,GAAG,KAAK,EAAE;AAAA,IACnE;AACA,wBAAoB,KAAK,EAAC,YAAY,MAAK,CAAC;AAAA,EAC9C;AAEA,SAAO;AAAA,IACL,KAAK,IAAI,SAAS;AAAA,IAClB,SAAS,EAAC,GAAG,gBAAgB,QAAO;AAAA,IACpC,aAAa;AAAA,EACf;AACF;AAGA,eAAe,kBACb,YACA,KACA,UACwB;AACxB,QAAM,kBAAkB,gBAAgB,IAAI,UAAU;AACtD,MAAI,gBAAiB,QAAO;AAC5B,QAAM,gBAAgB,WAAW;AACjC,QAAM,UAAU,QAAQ;AAAA,IACtB,cAAc;AAAA,MACZ;AAAA,MACA,QAAQ;AAAA,MACR,UAAU,EAAC,QAAQ,SAAS,QAAQ,SAAS,SAAS,QAAO;AAAA,IAC/D,CAAC;AAAA,EACH,EAAE,QAAQ,MAAM,gBAAgB,OAAO,UAAU,CAAC;AAClD,kBAAgB,IAAI,YAAY,OAAO;AACvC,SAAO;AACT;AAGA,eAAe,aACb,OACA,SACwB;AACxB,SAAO,OAAO,UAAU,aAAa,MAAM,OAAO,IAAI;AACxD;AAGA,SAAS,iBAAiB,SAAsC;AAC9D,MAAI,CAAC,QAAQ,OAAQ,OAAM,IAAI,MAAM,wDAAwD;AAC7F,SAAO,QAAQ,IAAI,YAAU;AAC3B,UAAM,MAAM,IAAI,IAAI,MAAM;AAC1B,QACE,CAAC,CAAC,SAAS,QAAQ,EAAE,SAAS,IAAI,QAAQ,KAC1C,IAAI,aAAa,OACjB,IAAI,UACJ,IAAI,MACJ;AACA,YAAM,IAAI,MAAM,+DAA+D,MAAM,EAAE;AAAA,IACzF;AACA,WAAO,IAAI;AAAA,EACb,CAAC;AACH;AAGA,SAAS,aAAa,KAAyB;AAC7C,MAAI;AACF,UAAM,YAAY,IAAI,IAAI,GAAG;AAC7B,WAAO,CAAC,SAAS,QAAQ,EAAE,SAAS,UAAU,QAAQ,IAAI,YAAY;AAAA,EACxE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,oBAAoB,SAA+B;AAC1D,QAAM,UAAU,QAAQ,UAAU,OAAO,YAAY;AACrD,MAAI,CAAC,CAAC,OAAO,QAAQ,WAAW,OAAO,QAAQ,EAAE,SAAS,MAAM,EAAG,QAAO;AAC1E,SAAO,EACL,QAAQ,QACR,OAAO,mBAAmB,eAC1B,QAAQ,gBAAgB;AAE5B;AAGA,SAAS,mBAAiC;AACxC,SAAO,IAAI,aAAa,8BAA8B,YAAY;AACpE;;;AC9iBA,IAAM,wBAAwB;AAGxB,IAAO,uBAAP,cAAoC,oBAAmB;;EAE3D,OAAgB,OAAO;;EAEvB,YAAY,SAAgC;AAC1C,UAAM,uBAAuB,OAAO,CAAC;EACvC;;AAII,IAAO,2BAAP,cAAwC,oBAAmB;;EAE/D,OAAgB,OAAO;;EAEvB,YAAY,SAAoC;AAC9C,UAAM,2BAA2B,OAAO,CAAC;EAC3C;;AAII,IAAO,0BAAP,cAAuC,oBAAmB;;EAE9D,OAAgB,OAAO;;EAEvB,YAAY,SAAmC;AAC7C,UAAM,0BAA0B,OAAO,CAAC;EAC1C;;AAEF,IAAM,2BAA2B;EAC/B;EACA;;AAkCI,SAAU,uBAAuB,SAAgC;AACrE,SAAO,+BAA+B;IACpC,IAAI;IACJ,SAAS,QAAQ,WAAW,CAAC,wBAAwB;IACrD,eAAe;IACf,OAAO,QAAQ;GAChB;AACH;AAGM,SAAU,2BACd,SAAoC;AAEpC,SAAO,+BAA+B;IACpC,IAAI;IACJ,SAAS,QAAQ,WAAW,CAAC,6BAA6B;IAC1D,eAAe;IACf,OAAO,QAAQ;GAChB;AACH;AASM,SAAU,0BAA0B,SAAmC;AAC3E,MAAI,QAAQ,YAAY,UAAa,QAAQ,YAAY,MAAM;AAC7D,WAAO,4BAA4B;MACjC,IAAI;MACJ,SAAS,QAAQ,WAAW,CAAC,qBAAqB;MAClD,OAAO,QAAQ;KAChB;EACH;AAEA,QAAM,UAAU,QAAQ;AACxB,QAAM,UAAU,QAAQ,WAAW;AACnC,MAAI,uBAAsD;AAE1D,SAAO,4BAA4B;IACjC,IAAI,oBAAoB,OAAO;IAC/B;IACA,OAAO,aAAU;AACf,UAAI,QAAQ,WAAW,WAAW;AAChC,+BAAuB;MACzB;AACA,+BAAyB,2BAA2B,SAAS,SAAS,SAAS,OAAO;AACtF,aAAO;IACT;GACD;AACH;AAGA,eAAe,2BACb,SACA,SACA,SACA,SAA6B;AAE7B,QAAM,cAAc,GAAG,qBAAqB,cAAc,OAAO;AACjE,QAAM,cACJ,OAAO,QAAQ,gBAAgB,aAC3B,MAAM,QAAQ,YAAY,EAAC,GAAG,SAAS,KAAK,YAAW,CAAC,IACxD,QAAQ;AACd,MAAI,CAAC;AAAa,WAAO;AAEzB,QAAM,YAAY,QAAQ,aAAa;AACvC,MACE,cAAc,WACb,cAAc,UAAU,sBAAsB,aAAa,OAAO,GACnE;AACA,WAAO;EACT;AAEA,QAAM,gBAAgB,4BAA4B;IAChD,IAAI,kBAAkB,OAAO;IAC7B,SAAS,CAAC,qBAAqB;IAC/B,OAAO;GACR;AACD,QAAM,WAAW,yBAAyB;IACxC,OAAO,QAAQ;IACf,aAAa,CAAC,aAAa;GAC5B;AACD,QAAM,WAAW,MAAM,SAAS,WAAW;AAC3C,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,oBAAoB,OAAO,6BAA6B,SAAS,MAAM,EAAE;EAC3F;AAEA,QAAM,WAAY,MAAM,SAAS,KAAI;AACrC,MAAI,OAAO,SAAS,QAAQ,YAAY,CAAC,QAAQ,SAAS,IAAI,IAAI,SAAS,GAAG,EAAE,MAAM,GAAG;AACvF,UAAM,IAAI,MAAM,oBAAoB,OAAO,sCAAsC;EACnF;AACA,MAAI,OAAO,SAAS,gBAAgB,YAAY,CAAC,SAAS,aAAa;AACrE,UAAM,IAAI,MAAM,yDAAyD,OAAO,GAAG;EACrF;AACA,SAAO,SAAS;AAClB;AAGA,SAAS,sBAAsB,OAAe,SAAwB;AACpE,MAAI;AACF,UAAM,gBAAgB,MAAM,MAAM,GAAG,EAAE,CAAC;AACxC,QAAI,CAAC;AAAe,aAAO;AAC3B,UAAM,SAAS,cAAc,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AACjE,UAAM,eAAe,OAAO,OAAO,KAAK,KAAK,OAAO,SAAS,CAAC,IAAI,GAAG,GAAG;AACxE,UAAM,SAAS,KAAK,MAAM,KAAK,YAAY,CAAC;AAC5C,WACE,MAAM,QAAQ,OAAO,MAAM,KAC3B,OAAO,OAAO,KAAK,kBAAgB,OAAO,YAAY,MAAM,OAAO,OAAO,CAAC;EAE/E,QAAQ;AACN,WAAO;EACT;AACF;",
+  "names": ["authentication", "_a"]
+}

package/dist/index.d.ts

@@ -0,0 +1,3 @@
+export { MapboxAuthentication, GoogleMapsAuthentication, CesiumIonAuthentication, createCesiumIonCredential, createGoogleMapsCredential, createMapboxCredential } from "./authentication.js";
+export type { CesiumIonCredentialOptions, GoogleMapsCredentialOptions, MapboxCredentialOptions, ServiceCredentialOptions } from "./authentication.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAIA,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACvB,4BAAyB;AAC1B,YAAY,EACV,0BAA0B,EAC1B,2BAA2B,EAC3B,uBAAuB,EACvB,wBAAwB,EACzB,4BAAyB"}

package/dist/index.js

@@ -0,0 +1,5 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+export { MapboxAuthentication, GoogleMapsAuthentication, CesiumIonAuthentication, createCesiumIonCredential, createGoogleMapsCredential, createMapboxCredential } from "./authentication.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,+BAA+B;AAC/B,oCAAoC;AAEpC,OAAO,EACL,oBAAoB,EACpB,wBAAwB,EACxB,uBAAuB,EACvB,yBAAyB,EACzB,0BAA0B,EAC1B,sBAAsB,EACvB,4BAAyB"}

package/dist/unbundled.d.ts

@@ -0,0 +1,2 @@
+export * from "./index.js";
+//# sourceMappingURL=unbundled.d.ts.map

package/dist/unbundled.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"unbundled.d.ts","sourceRoot":"","sources":["../src/unbundled.ts"],"names":[],"mappings":"AAKA,2BAAwB"}

package/dist/unbundled.js

@@ -0,0 +1,6 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+// ArcGIS sources are already metadata-only entrypoints and have no parser bundle to defer.
+export * from "./index.js";
+//# sourceMappingURL=unbundled.js.map

package/dist/unbundled.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unbundled.js","sourceRoot":"","sources":["../src/unbundled.ts"],"names":[],"mappings":"AAAA,aAAa;AACb,+BAA+B;AAC/B,oCAAoC;AAEpC,2FAA2F;AAC3F,2BAAwB"}

package/package.json

@@ -0,0 +1,54 @@
+{
+  "name": "@loaders.gl/services",
+  "version": "5.0.0-alpha.10",
+  "description": "Authentication presets for geospatial service providers",
+  "license": "MIT",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/visgl/loaders.gl"
+  },
+  "keywords": [
+    "authentication",
+    "services",
+    "geospatial"
+  ],
+  "types": "dist/index.d.ts",
+  "main": "dist/index.cjs",
+  "module": "dist/index.js",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "require": "./dist/index.cjs"
+    },
+    "./unbundled": {
+      "types": "./dist/unbundled.d.ts",
+      "import": "./dist/unbundled.js"
+    },
+    "./bundled": {
+      "types": "./dist/bundled.d.ts",
+      "import": "./dist/bundled.js"
+    },
+    "./authentication": {
+      "types": "./dist/authentication.d.ts",
+      "import": "./dist/authentication.js"
+    }
+  },
+  "sideEffects": false,
+  "files": [
+    "src",
+    "dist",
+    "README.md"
+  ],
+  "dependencies": {
+    "@loaders.gl/loader-utils": "5.0.0-alpha.10"
+  },
+  "peerDependencies": {
+    "@loaders.gl/core": "~5.0.0-alpha.0"
+  },
+  "gitHead": "7cbfaef633e86356c946541dab4977b522745b6c"
+}

package/src/authentication.ts

@@ -0,0 +1,200 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+
+import type {
+  FetchLike,
+  RequestCredential,
+  TokenProviderContext,
+  TokenValue
+} from '@loaders.gl/loader-utils';
+import {
+  createAuthenticatedFetch,
+  TokenAuthentication,
+  createBearerTokenCredential,
+  createQueryParameterCredential
+} from '@loaders.gl/loader-utils';
+
+const CESIUM_ION_API_ORIGIN = 'https://api.cesium.com';
+
+/** Declarative Mapbox access-token authentication. */
+export class MapboxAuthentication extends TokenAuthentication {
+  /** Discriminator used in `core.credentials`. */
+  static readonly type = 'mapbox';
+  /** Creates a Mapbox credential with the existing provider defaults. */
+  constructor(options: MapboxCredentialOptions) {
+    super(createMapboxCredential(options));
+  }
+}
+
+/** Declarative Google Maps API-key authentication. */
+export class GoogleMapsAuthentication extends TokenAuthentication {
+  /** Discriminator used in `core.credentials`. */
+  static readonly type = 'google-maps';
+  /** Creates a Google Maps credential with the existing provider defaults. */
+  constructor(options: GoogleMapsCredentialOptions) {
+    super(createGoogleMapsCredential(options));
+  }
+}
+
+/** Declarative Cesium ion authentication, including lazy asset-token exchange. */
+export class CesiumIonAuthentication extends TokenAuthentication {
+  /** Discriminator used in `core.credentials`. */
+  static readonly type = 'cesium-ion';
+  /** Creates an ion credential with the existing provider lifecycle. */
+  constructor(options: CesiumIonCredentialOptions) {
+    super(createCesiumIonCredential(options));
+  }
+}
+const CESIUM_ION_ASSET_ORIGINS = [
+  'https://assets.ion.cesium.com',
+  'https://assets.cesium.com'
+] as const;
+
+/** Shared options for provider credential presets with known public API origins. */
+export type ServiceCredentialOptions = {
+  /** Replaces the provider's default exact-origin allowlist. */
+  origins?: readonly string[];
+};
+
+/** Options for a Mapbox API credential. */
+export type MapboxCredentialOptions = ServiceCredentialOptions & {
+  /** Mapbox public access token or application-managed token callback. */
+  accessToken: TokenValue;
+};
+
+/** Options for a Google Maps Platform credential. */
+export type GoogleMapsCredentialOptions = ServiceCredentialOptions & {
+  /** Google Maps Platform API key or application-managed key callback. */
+  apiKey: TokenValue;
+};
+
+/** Options for a Cesium ion API credential. */
+export type CesiumIonCredentialOptions = ServiceCredentialOptions & {
+  /** Cesium ion access token or application-managed token callback. */
+  accessToken: TokenValue;
+  /** Optional asset whose endpoint-scoped token should be resolved. */
+  assetId?: number | string;
+  /** Overrides the transport used for the ion endpoint-token exchange. */
+  fetch?: FetchLike;
+  /** Whether the supplied token is account-scoped or already asset-scoped. */
+  tokenType?: 'account' | 'asset' | 'auto';
+};
+
+/** Creates a Mapbox `access_token` query credential. */
+export function createMapboxCredential(options: MapboxCredentialOptions): RequestCredential {
+  return createQueryParameterCredential({
+    id: 'mapbox-access-token',
+    origins: options.origins || ['https://api.mapbox.com'],
+    parameterName: 'access_token',
+    token: options.accessToken
+  });
+}
+
+/** Creates a Google Maps Platform `key` query credential. */
+export function createGoogleMapsCredential(
+  options: GoogleMapsCredentialOptions
+): RequestCredential {
+  return createQueryParameterCredential({
+    id: 'google-maps-api-key',
+    origins: options.origins || ['https://tile.googleapis.com'],
+    parameterName: 'key',
+    token: options.apiKey
+  });
+}
+
+/**
+ * Creates a bearer credential for the Cesium ion REST API or one Cesium ion asset.
+ *
+ * Supplying `assetId` creates an asset-origin credential. Account tokens are exchanged lazily
+ * through Cesium ion's endpoint API; legacy asset-scoped tokens are used directly. Without an
+ * `assetId`, the credential is scoped only to the ion REST API for backwards compatibility.
+ */
+export function createCesiumIonCredential(options: CesiumIonCredentialOptions): RequestCredential {
+  if (options.assetId === undefined || options.assetId === null) {
+    return createBearerTokenCredential({
+      id: 'cesium-ion-access-token',
+      origins: options.origins || [CESIUM_ION_API_ORIGIN],
+      token: options.accessToken
+    });
+  }
+
+  const assetId = options.assetId;
+  const origins = options.origins || CESIUM_ION_ASSET_ORIGINS;
+  let endpointTokenPromise: Promise<string | null> | null = null;
+
+  return createBearerTokenCredential({
+    id: `cesium-ion-asset-${assetId}`,
+    origins,
+    token: context => {
+      if (context.reason === 'refresh') {
+        endpointTokenPromise = null;
+      }
+      endpointTokenPromise ||= resolveCesiumIonAssetToken(options, assetId, origins, context);
+      return endpointTokenPromise;
+    }
+  });
+}
+
+/** Resolves an account token and exchanges it for an asset endpoint token when required. */
+async function resolveCesiumIonAssetToken(
+  options: CesiumIonCredentialOptions,
+  assetId: number | string,
+  origins: readonly string[],
+  context: TokenProviderContext
+): Promise<string | null> {
+  const endpointURL = `${CESIUM_ION_API_ORIGIN}/v1/assets/${assetId}/endpoint`;
+  const accessToken =
+    typeof options.accessToken === 'function'
+      ? await options.accessToken({...context, url: endpointURL})
+      : options.accessToken;
+  if (!accessToken) return null;
+
+  const tokenType = options.tokenType || 'auto';
+  if (
+    tokenType === 'asset' ||
+    (tokenType === 'auto' && isCesiumIonAssetToken(accessToken, assetId))
+  ) {
+    return accessToken;
+  }
+
+  const apiCredential = createBearerTokenCredential({
+    id: `cesium-ion-api-${assetId}`,
+    origins: [CESIUM_ION_API_ORIGIN],
+    token: accessToken
+  });
+  const ionFetch = createAuthenticatedFetch({
+    fetch: options.fetch,
+    credentials: [apiCredential]
+  });
+  const response = await ionFetch(endpointURL);
+  if (!response.ok) {
+    throw new Error(`Cesium ion asset ${assetId} endpoint request failed: ${response.status}`);
+  }
+
+  const endpoint = (await response.json()) as {accessToken?: unknown; url?: unknown};
+  if (typeof endpoint.url !== 'string' || !origins.includes(new URL(endpoint.url).origin)) {
+    throw new Error(`Cesium ion asset ${assetId} resolved to an unconfigured origin.`);
+  }
+  if (typeof endpoint.accessToken !== 'string' || !endpoint.accessToken) {
+    throw new Error(`Cesium ion did not return an endpoint token for asset ${assetId}.`);
+  }
+  return endpoint.accessToken;
+}
+
+/** Detects legacy JWTs whose claims scope them directly to the requested asset. */
+function isCesiumIonAssetToken(token: string, assetId: number | string): boolean {
+  try {
+    const encodedClaims = token.split('.')[1];
+    if (!encodedClaims) return false;
+    const base64 = encodedClaims.replace(/-/g, '+').replace(/_/g, '/');
+    const paddedBase64 = base64.padEnd(Math.ceil(base64.length / 4) * 4, '=');
+    const claims = JSON.parse(atob(paddedBase64)) as {assets?: unknown};
+    return (
+      Array.isArray(claims.assets) &&
+      claims.assets.some(claimAssetId => String(claimAssetId) === String(assetId))
+    );
+  } catch {
+    return false;
+  }
+}

package/src/bundled.ts

@@ -0,0 +1,6 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+
+// ArcGIS sources have no parser-only implementation to defer.
+export * from './index';

package/src/index.ts

@@ -0,0 +1,18 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+
+export {
+  MapboxAuthentication,
+  GoogleMapsAuthentication,
+  CesiumIonAuthentication,
+  createCesiumIonCredential,
+  createGoogleMapsCredential,
+  createMapboxCredential
+} from './authentication';
+export type {
+  CesiumIonCredentialOptions,
+  GoogleMapsCredentialOptions,
+  MapboxCredentialOptions,
+  ServiceCredentialOptions
+} from './authentication';

package/src/unbundled.ts

@@ -0,0 +1,6 @@
+// loaders.gl
+// SPDX-License-Identifier: MIT
+// Copyright (c) vis.gl contributors
+
+// ArcGIS sources are already metadata-only entrypoints and have no parser bundle to defer.
+export * from './index';